Security Policy

Last updated: 2026-10-16

1. Hosting & Infrastructure

Sentinel is hosted exclusively on servers operated by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Deutschland), located in the European Union (Germany). No data is processed or stored outside the EU, except via the AI analysis sub-processors described in our Privacy Policy and governed by EU Standard Contractual Clauses (SCCs).

2. Encryption in Transit

All communications between your browser and Sentinel are encrypted using TLS 1.2 or TLS 1.3. HTTPS is enforced on all endpoints; HTTP connections are automatically redirected. Certificates are issued and renewed automatically by the reverse proxy (Caddy) via Let's Encrypt.

3. Backups

The PostgreSQL database is backed up daily. Backups are retained for 30 days in an isolated volume on the same Hetzner infrastructure. Restoration procedures are documented and tested periodically.

4. Responsible Disclosure

If you discover a security vulnerability affecting Sentinel, we encourage you to report it responsibly before any public disclosure. Please contact us at contact@sentinelbriefing.com with:

• a description of the vulnerability and its potential impact;
• steps to reproduce or a proof of concept;
• your contact details (optional, for follow-up).

We commit to acknowledging your report within 72 hours, keeping you informed of our remediation progress, and not taking legal action against researchers acting in good faith under coordinated disclosure. We do not currently operate a bug bounty programme.

5. Machine-readable Security Policy

Our security.txt (RFC 9116) is available at /.well-known/security.txt.

← Back to Sentinel